Laravel Debug Routes in Production: How to Find and Remove Test Endpoints

The Problem

How to Fix

1. 1

   Find debug routes in your route files

   Search for common debug patterns:

   grep -rn 'phpinfo\|dd(\|dump(\|var_dump\|print_r' routes/ --include='*.php'
   grep -rn 'test\|debug\|tmp\|temp\|_dev' routes/ --include='*.php'

   Also list all registered routes and look for suspicious ones:

   php artisan route:list | grep -i 'test\|debug\|info\|dump'

2. 2

   Remove or protect debug routes

   Delete debug routes entirely, or if they are needed for development, wrap them in an environment check:

   // REMOVE completely — preferred
   // Route::get('/phpinfo', fn() => phpinfo());

   // Or restrict to local environment only
   if (app()->environment('local')) {
       Route::get('/debug-info', function () {
           return response()->json([
               'php' => phpversion(),
               'laravel' => app()->version(),
           ]);
       });
   }

3. 3

   Add a CI check to prevent debug routes in production

   Add a test that fails if debug routes exist:

   // tests/Feature/NoDebugRoutesTest.php
   public function test_no_debug_routes_exist(): void
   {
       $debugPatterns = ['phpinfo', 'debug', '_test', '_dev'];
       $routes = collect(Route::getRoutes())->map(fn ($r) => $r->uri());

   foreach ($debugPatterns as $pattern) {
           $matches = $routes->filter(fn ($uri) => str_contains($uri, $pattern));
           $this->assertEmpty($matches, "Debug route found: {$matches->implode(', ')}");
       }
   }

How to Verify

curl -s -o /dev/null -w '%{http_code}' https://yourapp.com/phpinfo
curl -s -o /dev/null -w '%{http_code}' https://yourapp.com/test
curl -s -o /dev/null -w '%{http_code}' https://yourapp.com/debug

Prevention

Frequently Asked Questions